Suppose i have a crypto provider
, i.e: i give that provider some plaintext bytes and get the encrypted result.
I don't know the used encryption method, but i know it is using a block cipher and the Block cipher mode of operation is something behaving like ECB (every block is encrypted individually => 2 identical blocks of plaintext should lead to 2 identical blocks of ciphertext, if there is no prefix) and thus vulnerable to different padding attacks.
The crypto provider
may add a prefix and suffix to the plaintext but i don't know if and how long they are.
I want to execute different padding attacks on this crypto provider
(Detect prefix and suffix length, bruteforce suffix in linear time, strip pre- and suffix, ...).
In fact everything works, but i need to know if the padding method used by the crypto provider
is appending a padding block if the length of the plaintext % blocksize == 0
. Otherwise my calculation of the length of prefix + suffix might be wrong.
Giving the described circumstances, is there a way to detect this without having to test for the exact used padding scheme ?
What i do atm:
To detect the blocksize
and prefix
+ suffix
length i start with encrypting one byte, get the length of the cipertext (cipher_a
) and then add one byte to the plaintext (plaintext_n
) till the length of the cipyertext (cipher_n
) is larger as the first one.
Now i know:
blocksize = length(cipher_n) - length(cipher_a)
If the padding used DOES add an empty padding block:
fixes_length = length(cipher_a) - length(plaintext_n)
Otherwise:
fixes_length = length(cipher_a) - length(plaintext_n) -1
Short example which (hopefully) shows the problematic.
Suppose: blocksize = 3
, prefix = "xx"
, suffix = "yy"
:
With an empty padding block:
╔═══════╦═════════════╦═════════╗
║ Chars ║ Plaintext ║ Blocks ║
╠═══════╬═════════════╬═════════╣
║ 1 ║ xxa yy- ║ 2 ║
║ 2 ║ xxa ayy --- ║ 3 ║
╚═══════╩═════════════╩═════════╝
In this case the calculation is correct.
blocksize = 3
fixes_length = 6 - 2 = 4
Without an empty padding block:
╔═══════╦═════════════╦═════════╗
║ Chars ║ Plaintext ║ Blocks ║
╠═══════╬═════════════╬═════════╣
║ 1 ║ xxa yy- ║ 2 ║
║ 2 ║ xxa ayy ║ 2 ║
║ 3 ║ xxa aay y-- ║ 3 ║
╚═══════╩═════════════╩═════════╝
This fixes_length is wrong.
blocksize = 3
fixes_length = 6 - 3 = 3
I am relatively new to cryptography, so please excuse me if i got some terminology wrong